feat: entropy-based secret detection for exception code variables

Add a last-resort entropy-based detector that redacts high-entropy,
secret-looking values (API keys, tokens, strong passwords) sitting in
innocuously-named code variables, after the existing name-pattern and
URL-credential checks.

- Known vendor key formats (OpenAI, Anthropic, AWS, Stripe, GitHub,
  GitLab, Slack, Google, JWT, PEM private keys) are matched directly.
- Structured identifiers (UUIDs, Mongo ObjectIds, hashes), object reprs,
  file paths and URLs are never flagged.
- Exposed as the `code_variables_detect_secrets` option (default True)
  with a per-context override, threaded through client/contexts.
- Tighten the masking size caps to keep capture cost bounded.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: ablaszkiewicz

.sampo/changesets/entropy-secret-detection.md

@@ -0,0 +1,5 @@
+---
+'pypi/posthog': patch
+---
+
+Add entropy-based secret detection as a last-resort redaction step when capturing exception code variables. High-entropy, secret-looking values (API keys, tokens, strong passwords) sitting in innocuously-named variables are now redacted after the existing name-pattern and URL-credential checks. Well-known vendor key formats (OpenAI, Anthropic, AWS, Stripe, GitHub, GitLab, Slack, Google, JWT, PEM private keys) are matched directly, while structured identifiers (UUIDs, Mongo ObjectIds, hashes), object reprs, file paths and URLs are left intact. Adds the `code_variables_detect_secrets` option (default `True`) with a per-context override. Also tightens the code-variable size caps so capture stays bounded.

posthog/__init__.py

@@ -32,6 +32,9 @@
 from posthog.contexts import (
     set_code_variables_mask_url_credentials_context as inner_set_code_variables_mask_url_credentials_context,
 )
+from posthog.contexts import (
+    set_code_variables_detect_secrets_context as inner_set_code_variables_detect_secrets_context,
+)
 from posthog.contexts import (
     set_context_device_id as inner_set_context_device_id,
 )
@@ -45,6 +48,7 @@
     get_tags as inner_get_tags,
 )
 from posthog.exception_utils import (
+    DEFAULT_CODE_VARIABLES_DETECT_SECRETS,
     DEFAULT_CODE_VARIABLES_IGNORE_PATTERNS,
     DEFAULT_CODE_VARIABLES_MASK_PATTERNS,
     DEFAULT_CODE_VARIABLES_MASK_URL_CREDENTIALS,
@@ -244,6 +248,18 @@ def set_code_variables_mask_url_credentials_context(enabled: bool):
     return inner_set_code_variables_mask_url_credentials_context(enabled)
 
 
+def set_code_variables_detect_secrets_context(enabled: bool):
+    """
+    Whether to apply entropy-based secret detection as a last-resort redaction of
+    high-entropy values (API keys, tokens, strong passwords) in captured code
+    variables for the current context.
+
+    Category:
+        Contexts
+    """
+    return inner_set_code_variables_detect_secrets_context(enabled)
+
+
 def tag(name: str, value: Any):
     """
     Add a tag to the current context.
@@ -321,6 +337,9 @@ def get_tags() -> Dict[str, Any]:
         code variables.
     code_variables_ignore_patterns: Variable-name patterns to omit when capturing
         code variables.
+    code_variables_detect_secrets: Last-resort entropy-based redaction of
+        high-entropy secret-looking values (API keys, tokens, strong passwords)
+        in captured code variables. Defaults to True.
     in_app_modules: Module/package prefixes treated as in-app frames in captured
         exceptions.
     enable_exception_autocapture_rate_limiting: Rate limit autocaptured
@@ -365,6 +384,7 @@ def get_tags() -> Dict[str, Any]:
 code_variables_mask_patterns = DEFAULT_CODE_VARIABLES_MASK_PATTERNS
 code_variables_ignore_patterns = DEFAULT_CODE_VARIABLES_IGNORE_PATTERNS
 code_variables_mask_url_credentials = DEFAULT_CODE_VARIABLES_MASK_URL_CREDENTIALS
+code_variables_detect_secrets = DEFAULT_CODE_VARIABLES_DETECT_SECRETS
 in_app_modules = None  # type: Optional[list[str]]
 enable_exception_autocapture_rate_limiting = False  # type: bool
 exception_autocapture_bucket_size = ExceptionCapture.DEFAULT_BUCKET_SIZE  # type: int
@@ -1149,6 +1169,7 @@ def setup() -> Client:
             code_variables_mask_patterns=code_variables_mask_patterns,
             code_variables_ignore_patterns=code_variables_ignore_patterns,
             code_variables_mask_url_credentials=code_variables_mask_url_credentials,
+            code_variables_detect_secrets=code_variables_detect_secrets,
             in_app_modules=in_app_modules,
             enable_exception_autocapture_rate_limiting=enable_exception_autocapture_rate_limiting,
             exception_autocapture_bucket_size=exception_autocapture_bucket_size,

posthog/client.py

@@ -20,6 +20,7 @@
 from posthog.contexts import (
     _get_current_context,
     get_capture_exception_code_variables_context,
+    get_code_variables_detect_secrets_context,
     get_code_variables_ignore_patterns_context,
     get_code_variables_mask_patterns_context,
     get_code_variables_mask_url_credentials_context,
@@ -37,6 +38,7 @@
 from posthog.exception_capture import ExceptionCapture
 from posthog._logging import _configure_posthog_logging
 from posthog.exception_utils import (
+    DEFAULT_CODE_VARIABLES_DETECT_SECRETS,
     DEFAULT_CODE_VARIABLES_IGNORE_PATTERNS,
     DEFAULT_CODE_VARIABLES_MASK_PATTERNS,
     DEFAULT_CODE_VARIABLES_MASK_URL_CREDENTIALS,
@@ -251,6 +253,7 @@ def __init__(
         code_variables_mask_patterns=None,
         code_variables_ignore_patterns=None,
         code_variables_mask_url_credentials=None,
+        code_variables_detect_secrets=None,
         in_app_modules: list[str] | None = None,
         enable_exception_autocapture_rate_limiting=False,
         exception_autocapture_bucket_size=ExceptionCapture.DEFAULT_BUCKET_SIZE,
@@ -319,6 +322,11 @@ def __init__(
             code_variables_mask_url_credentials: Scrub credentials embedded in
                 URLs/DSNs (e.g. ``user:pass@host``) from captured code variables,
                 regardless of the surrounding variable name. Defaults to True.
+            code_variables_detect_secrets: Last-resort entropy-based detection that
+                redacts high-entropy secret-looking values (API keys, tokens, strong
+                passwords) sitting in innocuously-named variables, after the name and
+                URL checks. Skips structured ids (UUIDs, ObjectIds, hashes). Defaults
+                to True.
             in_app_modules: Module/package prefixes treated as in-app frames in
                 captured exceptions.
             enable_exception_autocapture_rate_limiting: Rate limit
@@ -417,6 +425,11 @@ def __init__(
             if code_variables_mask_url_credentials is not None
             else DEFAULT_CODE_VARIABLES_MASK_URL_CREDENTIALS
         )
+        self.code_variables_detect_secrets = (
+            code_variables_detect_secrets
+            if code_variables_detect_secrets is not None
+            else DEFAULT_CODE_VARIABLES_DETECT_SECRETS
+        )
         self.in_app_modules = in_app_modules
 
         if project_root is None:
@@ -1399,6 +1412,7 @@ def capture_exception(
             context_mask_url_credentials = (
                 get_code_variables_mask_url_credentials_context()
             )
+            context_detect_secrets = get_code_variables_detect_secrets_context()
 
             enabled = (
                 context_enabled
@@ -1420,6 +1434,11 @@ def capture_exception(
                 if context_mask_url_credentials is not None
                 else self.code_variables_mask_url_credentials
             )
+            detect_secrets = (
+                context_detect_secrets
+                if context_detect_secrets is not None
+                else self.code_variables_detect_secrets
+            )
 
             if enabled:
                 try_attach_code_variables_to_frames(
@@ -1428,6 +1447,7 @@ def capture_exception(
                     mask_patterns=mask_patterns,
                     ignore_patterns=ignore_patterns,
                     mask_url_credentials=mask_url_credentials,
+                    detect_secrets=detect_secrets,
                 )
 
             if self.log_captured_exceptions:

posthog/contexts.py

@@ -27,6 +27,7 @@ def __init__(
         self.code_variables_mask_patterns: Optional[list] = None
         self.code_variables_ignore_patterns: Optional[list] = None
         self.code_variables_mask_url_credentials: Optional[bool] = None
+        self.code_variables_detect_secrets: Optional[bool] = None
 
     def set_session_id(self, session_id: str):
         self.session_id = session_id
@@ -52,6 +53,9 @@ def set_code_variables_ignore_patterns(self, ignore_patterns: list):
     def set_code_variables_mask_url_credentials(self, enabled: bool):
         self.code_variables_mask_url_credentials = enabled
 
+    def set_code_variables_detect_secrets(self, enabled: bool):
+        self.code_variables_detect_secrets = enabled
+
     def get_parent(self):
         return self.parent
 
@@ -113,6 +117,13 @@ def get_code_variables_mask_url_credentials(self) -> Optional[bool]:
             return self.parent.get_code_variables_mask_url_credentials()
         return None
 
+    def get_code_variables_detect_secrets(self) -> Optional[bool]:
+        if self.code_variables_detect_secrets is not None:
+            return self.code_variables_detect_secrets
+        if self.parent is not None and not self.fresh:
+            return self.parent.get_code_variables_detect_secrets()
+        return None
+
 
 _context_stack: contextvars.ContextVar[Optional[ContextScope]] = contextvars.ContextVar(
     "posthog_context_stack", default=None
@@ -390,6 +401,17 @@ def set_code_variables_mask_url_credentials_context(enabled: bool) -> None:
         current_context.set_code_variables_mask_url_credentials(enabled)
 
 
+def set_code_variables_detect_secrets_context(enabled: bool) -> None:
+    """
+    Whether to apply entropy-based secret detection as a last-resort redaction of
+    high-entropy values (API keys, tokens, strong passwords) in captured code
+    variables for the current context.
+    """
+    current_context = _get_current_context()
+    if current_context:
+        current_context.set_code_variables_detect_secrets(enabled)
+
+
 def get_capture_exception_code_variables_context() -> Optional[bool]:
     current_context = _get_current_context()
     if current_context:
@@ -418,6 +440,13 @@ def get_code_variables_mask_url_credentials_context() -> Optional[bool]:
     return None
 
 
+def get_code_variables_detect_secrets_context() -> Optional[bool]:
+    current_context = _get_current_context()
+    if current_context:
+        return current_context.get_code_variables_detect_secrets()
+    return None
+
+
 F = TypeVar("F", bound=Callable[..., Any])